GCGA Ch. 7 Summarizing Secure Coding Concepts (ST)

Question 1

Input validation

Answer 1

A common coding error in web-based applications is the lack of input validation. Input validation checks the data before passing it to the application and prevents many types of attacks, including buffer overflow, SQL injection, command injection, and cross-site scripting attacks.

Question 2

Server-side input validation

Answer 2

the most secure. Attackers can bypass client-side input validation but not server-side input validation. It is common to use both.

Question 3

Race conditions

Answer 3

allow two processes to access the same data at the same time, causing inconsistent results. Problems can be avoided by locking data before accessing it.

Question 4

Error-handling

Answer 4

Error-handling routines within applications can prevent application failures and protect the integrity of the operating systems. Error messages shown to users should be generic, but the application should log detailed information on the error.

Question 5

Code signing

Answer 5

uses a digital signature within a certificate to authenticate and validate software code.

Question 6

Code quality and testing techniques

Answer 6

include static code analysis, dynamic analysis (such as fuzzing), stress testing, sandboxing, and model verification.

Question 7

SQL injection attacks

Answer 7

provide information about a database and can allow an attacker to read, modify, and delete data within a database. They commonly use the phrase ‘ or 1=1 to trick the database server into providing information. Input validation and stored procedures provide the best protection against SQL injection attacks.

Question 8

Secure cookies

Answer 8

have an attribute set that instructs web browsers to only send them over encrypted connections, protecting them from eavesdropping attacks.

Question 9

Buffer overflow

Answer 9

occurs when an application receives more input, or different input, than it expects. The result is an error that exposes system memory that would otherwise be protected and inaccessible.

Question 10

Directory traversal

Answer 10

a type of injection attack that attempts to access a file by including the full directory path or traversing the directory structure on a computer.

Question 11

XSS

Answer 11

Cross-site scripting (XSS) is a web application vulnerability that allows attackers to inject scripts into webpages